# Read access to hidden orders,products,customers etc. by limited access Staff member through reference page in Comments (Information disclosure )

Limited-access Shopify staff could reference order/customer IDs in timeline comments to leak order summaries and customer name, email, and photo despite lacking permissions.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: indoappsec
- Disclosed: 2018-12-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/154405
- Library page: https://bugbountylibrary.com/r/h1%3A154405
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:rest vuln:access-control vuln:idor vuln:info-disclosure

**Target:** Admin timeline_comments endpoint on transfers
**Root cause:** The timeline comment reference resolver (#O/#C syntax) fetched and rendered resource summaries without checking the commenting staff member's permissions on the referenced resource.
**Steps:**
1. Log in as staff with access to products but no access to orders/customers.
2. Open a product transfer and its comment section; the `#` reference picker only lists permitted products.
3. Post a comment with body `[#O3599995137|Order #1005]` (order ID) via `POST /admin/transfers/774529/timeline_comments`.
4. Observe the order summary rendered in the comment despite no order permission.
5. Use `[#C3502872769|anyword]` to leak customer name, email, and profile photo.
**How found:** Noticed the `#` reference picker only showed permitted resources, hypothesized the server-side resolver lacked the same permission check, and swapped a product ID for an order/customer ID in the intercepted comment request.
**Exploitation:** A low-privilege staff member posts a timeline comment referencing an arbitrary order or customer ID; the server resolves the reference and returns the resource summary in the comment, bypassing the permission model.
**Insight:** When a UI picker filters references by permission, test whether the server-side resolver enforces the same check by submitting IDs directly; rich-text mention/reference syntax is a common IDOR surface.